8173 matches found
CVE-2019-11198
Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...
Real Estate 7 < 2.9.1 - Stored XSS & IDOR
The 'Real Estate 7' premium WordPress theme is vulnerable to persistent XSS injection that allows an attacker to inject JavaScript or HTML code into the website front-end. There is also an Insecure Direct Object Reference issue, allowing unauthorized users to edit listings they should not have...
CVE-2019-14297
Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...
CVE-2019-14298
Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...
@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)
node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: SNYK:JS-NODEREDDASHBOARD-471939...
Cross-site Scripting (XSS)
Overview node-red-dashboard is a provides a set of nodes in Node-RED to quickly create a live data dashboard. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Details Remediation Upgrade node-red-dashboard to version 2.17.0 or higher. References - GitHub Commit Credit...
On the IoT road: perks, benefits and security of moving smartly
Kaspersky has repeatedly investigated security issues related to IoT technologies for instance, here, or here. Earlier this year our experts have even gained foothold in the security of biomechanical prosthetic devices. The same implies to smart car security: our own research has indicated that...
CVE-2019-1931
Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...
Cross site scripting
Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...
Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2019-21297)
Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A cross-site scripting vulnerability exists in the RSS dashboard of the web-based management interface in Cisco FMC, which stems from the web-based management interface failing to adequate...
Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2019-21303)
Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A cross-site scripting vulnerability exists in the RSS dashboard of the web-based management interface in Cisco FMC, which stems from the web-based management interface failing to adequate...
CVE-2016-5236
Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...
CVE-2016-5235
A Cross Site Scripting XSS vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert...
CVE-2016-5236
Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...
CVE-2016-5236
Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...
CVE-2016-5236
CVE-2016-5236 affects F5 WebSafe Dashboard (3.9.5 and earlier). The vulnerability is a Cross-Site Scripting (XSS) flaw that enables a privileged authenticated user to inject arbitrary script/HTML when creating a new user, account, or signature. The F5 advisory lists vulnerable products/features a...
CVE-2016-5235
Summary of CVE-2016-5235 (F5 WebSafe Dashboard XSS) The vulnerability affects the F5 WebSafe Dashboard (WebSafe Alert Server) and is triggered by an unauthenticated user who can inject HTML via a crafted alert in versions 3.9.x and earlier. The advisory confirms an XSS flaw that can be exploited ...
New Relic: Stored XSS via "my recent queries" selector in NRQL dashboard builder
This is a pretty simple one. Within NR One, there is a stored XSS via the dashboard builder. It appears in the "My recent queries" dropdown. You can attack other users with this bug by having them navigate to the link, I'll show an example below. Steps to Reproduce: 1. From NR1, navigate to the...